6114 matches found
DISCOUNT Denial of Service Vulnerability
DISCOUNT is a Markdown markup language implementation. A security vulnerability exists in the 'islist' function of the markdown.c file of the libmarkdown.a static link library in DISCOUNT version 2.2.3a. A remote attacker can exploit this vulnerability to cause a denial of service heap-based buff...
UBUNTU-CVE-2018-11504
The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file, as demonstrated by mkd2html...
UBUNTU-CVE-2018-11503
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file, as demonstrated by mkd2html...
DEBIAN-CVE-2018-11503
The isfootnote function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file, as demonstrated by mkd2html...
CVE-2018-11504
The CVE-2018-11504 issue affects the DISCOUNT Markdown parser (DISCOUNT 2.2.3a) specifically the islist function in markdown.c within libmarkdown.a, allowing a crafted file to trigger a heap-based buffer over-read and cause a denial of service. Public advisories in connected documents confirm the...
CVE-2018-11504
The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file, as demonstrated by mkd2html...
DEBIAN-CVE-2018-11468
The mkdtrimline function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file, as demonstrated by mkd2html...
Cross-Site Scripting
Overview All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from...
Cross-Site Scripting (XSS)
react-marked-markdown is vulnerable to cross-site scripting XSS. The vulnerability exists because it does not sanitize the href values to XSS-free string...
Node.js third-party modules: The react-marked-markdown module allows XSS injection in href values.
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08600)
Zulip Server is a set of open source group chat application written in Python based on the Django framework . frontend markdown processor is one of the front-end markdown markup language processor . A cross-site scripting vulnerability exists in the frontend markdown processor in Zulip Server...
CVE-2018-1000162
Parsedown prior to version 1.7.0 contains a Cross-Site Scripting (XSS) vulnerability in the setMarkupEscaped HTML escaping logic, exploitable via specially crafted Markdown that can bypass AST boundaries. The issue is documented under CVE-2018-1000162 and is stated to be fixed in 1.7.0 and later....
CVE-2018-9986
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...
Cross site scripting
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...
CVE-2018-9986
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...
CVE-2018-9986
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...
PT-2018-19149
Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 1.7.2 Description The issue is related to XSS problems with the frontend markdown processor. Recommendations For versions prior to 1.7.2, update to version 1.7.2 or later to resolve the issue...
CVE-2018-9986: Improper Neutralization of Input During Web Page Generation
In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...
CVE-2018-1000162: Improper Neutralization of Input During Web Page Generation
Parsedown version prior to 1.7.0 contains a Cross Site Scripting XSS vulnerability in setMarkupEscaped for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST...